“To gain full access to any privacy-protected directory, all an attacker has to do is establish an ssh connection”

Link. Apple left this open intentionally? Hard to grasp why unfixed.